Skip to content

Commit 3c8850e

Browse files
JonathanSolvesProblemsJonathanSolvesProblems
committed
Cite article sources + embed PNG architecture diagram + validator multi-format
- README quote attribution now links Wiedemann's CIO interview source. - Replit incident gets the Tom's Hardware article link inline. - Renamed Splunk-references section to "Citations and sources" and added every external URL referenced in the demo voiceover or the README body: IBM Cost of a Data Breach 2024, Verizon DBIR 2024, Tom's Hardware Replit coverage, CVE-2024-5184 on NVD, Wiedemann's CIO video, Splunk RSAC 2026 agentic-products blog. - README + architecture_diagram.md now reference architecture_diagram.png (renders once the drawio export lands at root) and link the .drawio source. - scripts/validate_all.py treats any of architecture_diagram.{md,png,pdf} at root as satisfying the Devpost requirement.
1 parent ce15295 commit 3c8850e

4 files changed

Lines changed: 163 additions & 8 deletions

File tree

‎README.md‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ A Splunk-native pre-action governance and blast-radius layer for AI agents. Buil
88

99
Splunk shipped six agentic capabilities in twelve months: Triage Agent, Investigation Agent, Malware Reversal Agent, AI Playbook Authoring, AI Assistant for SPL, Foundation-Sec-8B. Every one of them can read your data, propose changes, and (increasingly) execute them. **None of them answers compliance's question: who approved this action, and what was its blast radius?**
1010

11-
> *"The most likely outcome is that compliance and governance teams block the application from going to production."* — Jeff Wiedemann, Global AI Partner Technical Leader, Splunk
11+
> *"The most likely outcome is that compliance and governance teams block the application from going to production."* — Jeff Wiedemann, Global AI Partner Technical Leader, Splunk ([source: CIO interview](https://www.cio.com/video/4167955/splunk-tackles-ai-agent-blind-spots-with-new-observability-tools.html))
1212
1313
AgentGate is the gate between any AI agent and Splunk that produces an answerable trail of every decision.
1414

@@ -26,7 +26,9 @@ The **sixth stage** runs Foundation-Sec-1.1-8B-Instruct as an **advisory Finding
2626

2727
Every verdict, regardless of outcome, fans out to the `agentgate_audit` index via HEC. The bundled dashboard makes it the system of record for AI-agent governance.
2828

29-
See [architecture_diagram.md](architecture_diagram.md) for the full diagram, module map, and deterministic-vs-generative thesis.
29+
![AgentGate architecture: agent plane → 5-stage gate pipeline + advisory reasoning → Splunk outputs](architecture_diagram.png)
30+
31+
See [architecture_diagram.md](architecture_diagram.md) for the full module map and deterministic-vs-generative thesis; source diagram lives in [architecture_diagram.drawio](architecture_diagram.drawio).
3032

3133
## Measured performance
3234

@@ -70,7 +72,7 @@ The cost of getting AI-agent governance wrong is not hypothetical, and the numbe
7072

7173
Real recent incidents in the shape AgentGate guards against:
7274

73-
- **July 2025 — Replit's coding agent destroyed a customer's production database** despite an explicit code freeze instruction, and admitted to it on the next prompt. Widely reported; SaaStr's Jason Lemkin was the customer. POL-004 (destructive primitive) + POL-009 (mutation of system-of-record) would have blocked this pre-execution.
75+
- **July 2025 — Replit's coding agent destroyed a customer's production database** despite an explicit code freeze instruction, and admitted to it on the next prompt. Widely reported; SaaStr's Jason Lemkin was the customer ([Tom's Hardware coverage](https://www.tomshardware.com/tech-industry/artificial-intelligence/ai-coding-platform-goes-rogue-during-code-freeze-and-deletes-entire-company-database-replit-ceo-apologizes-after-ai-engine-says-it-made-a-catastrophic-error-in-judgment-and-destroyed-all-production-data)). POL-004 (destructive primitive) + POL-009 (mutation of system-of-record) would have blocked this pre-execution.
7476
- **CVE-2024-5184** — indirect prompt-injection vulnerability in an open-source LLM agent runtime, on NVD. The OWASP LLM01 family has continued to grow through 2025. POL-006 covers this attack class with measured precision 1.000 on the committed corpus.
7577
- **Splunk's own MCP Telemetry Dashboard (May 2026)** exists because customers are already running production AI agents against Splunk and ASKING for governance visibility. AgentGate is the pre-action half of the same need.
7678

@@ -168,20 +170,34 @@ The hackathon's resources page names five capability families. AgentGate touches
168170
- **Best Use of Splunk Hosted Models** ($1K) — Foundation-Sec-1.1-8B-Instruct on the reasoning stage, demonstrably swappable to the Splunk-hosted invocation in production.
169171
- **Best Use of Splunk Developer Tools** ($1K) — Built on the public `splunk-sdk` Python SDK (`splunklib.client` + `splunklib.results`), the Splunk REST API, KV-store collections, HEC, dashboard XML, and a fully-formed app bundle in `splunk_app/agentgate/` (savedsearches.conf, collections.conf, transforms.conf, dashboard XML, app.conf, metadata).
170172

171-
## Splunk references
173+
## Citations and sources
174+
175+
Every external claim in this README and in the demo video has a source URL.
172176

173-
Official docs and resources the build aligns to:
177+
**Splunk product and capability docs**
174178

175179
- [Splunk MCP Server on Splunkbase (app 7931)](https://splunkbase.splunk.com/app/7931)
176180
- [About MCP Server for Splunk platform](https://help.splunk.com/en/splunk-cloud-platform/mcp-server-for-splunk-platform/1.2/about-mcp-server-for-splunk-platform)
177181
- [Splunk MCP Server: Making Your Apps Agent-Ready](https://community.splunk.com/t5/Product-News-Announcements/GA-Splunk-MCP-Server-Making-Your-Apps-quot-Agent-Ready-quot/ba-p/759935)
178-
- [Foundation-Sec-1.1-8B-Instruct on Hugging Face](https://huggingface.co/fdtn-ai/Foundation-Sec-8B-Instruct)
179182
- [Splunk Hosted Models overview](https://www.splunk.com/en_us/blog/artificial-intelligence/splunk-launches-hosted-generative-ai-models.html)
183+
- [Foundation-Sec-1.1-8B-Instruct on Hugging Face](https://huggingface.co/fdtn-ai/Foundation-Sec-8B-Instruct)
180184
- [Splunk Python SDK (`splunk-sdk-python`)](https://github.com/splunk/splunk-sdk-python)
181185
- [Splunk Enterprise Security 8 API reference (Findings + Investigations)](https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.3/splunk-enterprise-security-api-reference)
182186
- [Splunk Developer Program](https://dev.splunk.com/) (developer license)
183187
- [Splunk Community Slack — #splunk-ai-hackathon](https://splk.it/slack)
184188

189+
**Pain quote and ecosystem context**
190+
191+
- [Jeff Wiedemann (Splunk) on AI-agent observability — CIO video interview](https://www.cio.com/video/4167955/splunk-tackles-ai-agent-blind-spots-with-new-observability-tools.html)
192+
- [Splunk ES at RSAC 2026: six agentic capabilities listed](https://www.splunk.com/en_us/blog/security/from-reactive-to-agentic-with-enterprise-security-at-rsac-2026.html)
193+
194+
**Cited harm anchors**
195+
196+
- [IBM Cost of a Data Breach Report 2024](https://www.ibm.com/reports/data-breach) — $4.88M average breach figure
197+
- [Verizon Data Breach Investigations Report 2024](https://www.verizon.com/business/resources/reports/dbir/) — human element involved in 68% of breaches
198+
- [Tom's Hardware — Replit AI coding platform deletes customer's production database (July 2025)](https://www.tomshardware.com/tech-industry/artificial-intelligence/ai-coding-platform-goes-rogue-during-code-freeze-and-deletes-entire-company-database-replit-ceo-apologizes-after-ai-engine-says-it-made-a-catastrophic-error-in-judgment-and-destroyed-all-production-data)
199+
- [CVE-2024-5184 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-5184) — indirect prompt-injection RCE in an open-source LLM agent runtime
200+
185201
## License
186202

187203
Apache 2.0.

‎architecture_diagram.drawio‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
<mxfile host="app.diagrams.net" agent="AgentGate" version="24.6.4">
2+
<diagram name="AgentGate Architecture" id="agentgate-arch">
3+
<mxGraphModel dx="1422" dy="800" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1654" pageHeight="1169" math="0" shadow="0" background="#1F1F1F">
4+
<root>
5+
<mxCell id="0" />
6+
<mxCell id="1" parent="0" />
7+
8+
<mxCell id="lane1" value="AGENT PLANE" style="rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontSize=18;fontStyle=1;fontColor=#FFFFFF;fillColor=#2A2A2A;strokeColor=#3A3A3A;spacingTop=8;" vertex="1" parent="1">
9+
<mxGeometry x="40" y="40" width="1574" height="180" as="geometry" />
10+
</mxCell>
11+
12+
<mxCell id="agent_claude" value="Claude" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=14;fontStyle=1;" vertex="1" parent="1">
13+
<mxGeometry x="130" y="100" width="280" height="80" as="geometry" />
14+
</mxCell>
15+
16+
<mxCell id="agent_cursor" value="Cursor / MCP clients" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=14;fontStyle=1;" vertex="1" parent="1">
17+
<mxGeometry x="470" y="100" width="280" height="80" as="geometry" />
18+
</mxCell>
19+
20+
<mxCell id="agent_triage" value="Splunk Triage Agent" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=14;fontStyle=1;" vertex="1" parent="1">
21+
<mxGeometry x="810" y="100" width="280" height="80" as="geometry" />
22+
</mxCell>
23+
24+
<mxCell id="agent_soar" value="SOAR Playbook" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=14;fontStyle=1;" vertex="1" parent="1">
25+
<mxGeometry x="1150" y="100" width="280" height="80" as="geometry" />
26+
</mxCell>
27+
28+
<mxCell id="lane2" value="AGENTGATE PIPELINE: 5 deterministic stages + 1 advisory" style="rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontSize=18;fontStyle=1;fontColor=#FFFFFF;fillColor=#0D2E1F;strokeColor=#1F5C3D;spacingTop=8;" vertex="1" parent="1">
29+
<mxGeometry x="40" y="260" width="1574" height="460" as="geometry" />
30+
</mxCell>
31+
32+
<mxCell id="mcp_entry" value="Splunk MCP Server: every tool call intercepted" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1A3D5C;strokeColor=#4DA6FF;fontColor=#FFFFFF;fontSize=14;fontStyle=1;" vertex="1" parent="1">
33+
<mxGeometry x="130" y="310" width="1390" height="40" as="geometry" />
34+
</mxCell>
35+
36+
<mxCell id="stage1" value="1. Injection&#10;&#10;pattern + homoglyph&#10;NIST AISC &#183; Anthropic&#10;AgentDojo &#183; INJECAGENT" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1A3D2A;strokeColor=#4CAF50;fontColor=#FFFFFF;fontSize=12;" vertex="1" parent="1">
37+
<mxGeometry x="80" y="380" width="270" height="130" as="geometry" />
38+
</mxCell>
39+
40+
<mxCell id="stage2" value="2. Blast Radius&#10;&#10;NetworkX KO graph walk&#10;saved search &#8594; assets&#10;MITRE &#183; compliance tags" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1A3D2A;strokeColor=#4CAF50;fontColor=#FFFFFF;fontSize=12;" vertex="1" parent="1">
41+
<mxGeometry x="380" y="380" width="270" height="130" as="geometry" />
42+
</mxCell>
43+
44+
<mxCell id="stage3" value="3. Cost&#10;&#10;SVC-hour estimate&#10;Cisco Deep Time Series&#10;Model (Cloud target)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1A3D2A;strokeColor=#4CAF50;fontColor=#FFFFFF;fontSize=12;" vertex="1" parent="1">
45+
<mxGeometry x="680" y="380" width="270" height="130" as="geometry" />
46+
</mxCell>
47+
48+
<mxCell id="stage4" value="4. Policy&#10;&#10;12 standards-mapped rules&#10;NIST AI RMF &#183; OWASP LLM&#10;PCI &#183; HIPAA &#183; SOX &#183; ISO 42001" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1A3D2A;strokeColor=#4CAF50;fontColor=#FFFFFF;fontSize=12;" vertex="1" parent="1">
49+
<mxGeometry x="980" y="380" width="270" height="130" as="geometry" />
50+
</mxCell>
51+
52+
<mxCell id="stage5" value="5. Decision&#10;&#10;ALLOW | REQUIRE_APPROVAL | BLOCK&#10;reads ONLY policy stage&#10;fail-closed on exception" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3D2A1A;strokeColor=#FFC107;fontColor=#FFFFFF;fontSize=12;fontStyle=1;" vertex="1" parent="1">
53+
<mxGeometry x="1280" y="380" width="270" height="130" as="geometry" />
54+
</mxCell>
55+
56+
<mxCell id="stage6" value="6. Reasoning (advisory)&#10;&#10;Foundation-Sec-1.1-8B-Instruct&#10;Ollama on dev license &#183; Splunk Hosted Models in prod&#10;NEVER gates the verdict; paragraph attaches to the Finding" style="rounded=1;whiteSpace=wrap;html=1;dashed=1;fillColor=#2A2A3D;strokeColor=#7B6AFF;fontColor=#FFFFFF;fontSize=12;" vertex="1" parent="1">
57+
<mxGeometry x="980" y="560" width="570" height="140" as="geometry" />
58+
</mxCell>
59+
60+
<mxCell id="e12" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="stage1" target="stage2">
61+
<mxGeometry relative="1" as="geometry" />
62+
</mxCell>
63+
<mxCell id="e23" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="stage2" target="stage3">
64+
<mxGeometry relative="1" as="geometry" />
65+
</mxCell>
66+
<mxCell id="e34" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="stage3" target="stage4">
67+
<mxGeometry relative="1" as="geometry" />
68+
</mxCell>
69+
<mxCell id="e45" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#FFC107;strokeWidth=2;" edge="1" parent="1" source="stage4" target="stage5">
70+
<mxGeometry relative="1" as="geometry" />
71+
</mxCell>
72+
73+
<mxCell id="e_c_mcp" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4DA6FF;strokeWidth=2;" edge="1" parent="1" source="agent_claude" target="mcp_entry">
74+
<mxGeometry relative="1" as="geometry" />
75+
</mxCell>
76+
<mxCell id="e_cu_mcp" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4DA6FF;strokeWidth=2;" edge="1" parent="1" source="agent_cursor" target="mcp_entry">
77+
<mxGeometry relative="1" as="geometry" />
78+
</mxCell>
79+
<mxCell id="e_t_mcp" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4DA6FF;strokeWidth=2;" edge="1" parent="1" source="agent_triage" target="mcp_entry">
80+
<mxGeometry relative="1" as="geometry" />
81+
</mxCell>
82+
<mxCell id="e_s_mcp" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4DA6FF;strokeWidth=2;" edge="1" parent="1" source="agent_soar" target="mcp_entry">
83+
<mxGeometry relative="1" as="geometry" />
84+
</mxCell>
85+
86+
<mxCell id="e_mcp_s1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="mcp_entry" target="stage1">
87+
<mxGeometry relative="1" as="geometry" />
88+
</mxCell>
89+
90+
<mxCell id="e_reason" value="advisory only" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;dashed=1;strokeColor=#7B6AFF;strokeWidth=2;fontColor=#FFFFFF;fontSize=11;" edge="1" parent="1" source="stage6" target="stage5">
91+
<mxGeometry relative="1" as="geometry" />
92+
</mxCell>
93+
94+
<mxCell id="lane3" value="SPLUNK OUTPUTS" style="rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontSize=18;fontStyle=1;fontColor=#FFFFFF;fillColor=#2A2A2A;strokeColor=#3A3A3A;spacingTop=8;" vertex="1" parent="1">
95+
<mxGeometry x="40" y="760" width="1574" height="220" as="geometry" />
96+
</mxCell>
97+
98+
<mxCell id="out_hec" value="HEC Audit Index&#10;&#10;every decision&#10;index=agentgate_audit" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=13;" vertex="1" parent="1">
99+
<mxGeometry x="120" y="820" width="380" height="130" as="geometry" />
100+
</mxCell>
101+
102+
<mxCell id="out_findings" value="ES 8 v2 Findings&#10;&#10;non-ALLOW verdicts&#10;/public/v2/investigations/{id}/findings&#10;KV-store mock during dev" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#FFC107;fontColor=#FFFFFF;fontSize=13;" vertex="1" parent="1">
103+
<mxGeometry x="630" y="820" width="380" height="130" as="geometry" />
104+
</mxCell>
105+
106+
<mxCell id="out_dash" value="Audit Dashboard&#10;&#10;Splunk simple-XML, dark theme&#10;traffic-light KPIs &#183; stage latency&#10;pending Findings &#183; block log" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#3A3A3A;strokeColor=#5A5A5A;fontColor=#FFFFFF;fontSize=13;" vertex="1" parent="1">
107+
<mxGeometry x="1140" y="820" width="380" height="130" as="geometry" />
108+
</mxCell>
109+
110+
<mxCell id="e_dec_hec" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="stage5" target="out_hec">
111+
<mxGeometry relative="1" as="geometry" />
112+
</mxCell>
113+
<mxCell id="e_dec_find" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#FFC107;strokeWidth=2;" edge="1" parent="1" source="stage5" target="out_findings">
114+
<mxGeometry relative="1" as="geometry" />
115+
</mxCell>
116+
<mxCell id="e_dec_dash" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;endArrow=classic;strokeColor=#4CAF50;strokeWidth=2;" edge="1" parent="1" source="stage5" target="out_dash">
117+
<mxGeometry relative="1" as="geometry" />
118+
</mxCell>
119+
120+
</root>
121+
</mxGraphModel>
122+
</diagram>
123+
</mxfile>

‎architecture_diagram.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
Splunk-native pre-action governance + blast-radius layer for AI agents acting on Splunk. Repository root canonical architecture artifact (Devpost-required filename).
44

5+
![AgentGate architecture: agent plane → 5-stage gate pipeline + advisory reasoning → Splunk outputs (HEC audit, ES 8 Findings, dashboard)](architecture_diagram.png)
6+
7+
Source diagram editable in draw.io: [architecture_diagram.drawio](architecture_diagram.drawio).
8+
59
## Three planes
610

711
```

‎scripts/validate_all.py‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -296,11 +296,23 @@ def c_pytest_fast() -> CheckResult:
296296

297297

298298
def c_repo_files() -> CheckResult:
299-
required = ["LICENSE", "README.md", "architecture_diagram.md", ".env", "requirements.txt"]
299+
required = ["LICENSE", "README.md", ".env", "requirements.txt"]
300300
missing = [f for f in required if not (REPO_ROOT / f).exists()]
301+
# Devpost accepts any of .md / .png / .pdf for architecture_diagram
302+
arch_candidates = [f"architecture_diagram{ext}" for ext in (".png", ".md", ".pdf")]
303+
arch_present = [f for f in arch_candidates if (REPO_ROOT / f).exists()]
301304
if missing:
302305
return CheckResult("Repo files present", False, f"missing: {missing}", "")
303-
return CheckResult("Repo files present", True, "LICENSE + README + architecture_diagram + .env + requirements")
306+
if not arch_present:
307+
return CheckResult(
308+
"Repo files present", False,
309+
"missing architecture_diagram.(md|png|pdf) at repo root",
310+
"export the drawio as PNG to repo root",
311+
)
312+
return CheckResult(
313+
"Repo files present", True,
314+
f"LICENSE + README + {', '.join(arch_present)} + .env + requirements",
315+
)
304316

305317

306318
def c_submission_artifacts() -> CheckResult:

0 commit comments

Comments
 (0)